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MSIT PRECIS 

BERN ARD B ARRIER 

(PHONETIC: bear-NAR bar-B YAY) 

Technical Director 

Directorate for External Security (DGSE), France 

PATRICK PAILLOUX 

(PHONETIC : pah-TREEK pie-YOO) 

Director 

National Information Systems Security (ANSSI), France 

12 April 2013 



Guests Arrive at GH2B: 1030 

Technical Presentation and Discussions: (1045-1215) 

D DIR-Hosted Lunch: (1215-1300) 

NSOC Courtesy Call (1300-1330) 

NTOC Courtesy Call (1330-1430) 

DIRNSA Courtesy Ca ll: (1430-1500) 

Accompanying Senior 



(l ) BACKGROUND: 

• (TS '.SI NT) Mr Bathier and Mr. Patrick Pailloux will travel to NSA on 12 April 2013 to 
share information regarding May 2012 cyber attacks on the French Presidential network 
In November 2012. a French magazine revealed information about the attacks and 
accused the U.S. of being responsible. During a January 2013 visit, unbeknownst to FAD 
Desk Officers and SUSLAF. DGSE and ANSSI questioned DIRNSA about the cyber 
attacks and asked about U S involvement DIRNSA denied U S involvement and offered 
NSA's assistance to France in attributing the attacks. Two (2) NSA CSS Threat 
Operations Center (NTOC) Analysts were prepared to travel to Paris in March to provide 
support to the French. DGSE and ANSSI canceled the meeting the day before the team 
was scheduled to depart and instead, requested a visit to NSA on 12 April For this visit. 
Mr. Barbier and Mr Pailloux will be accompanied by: 
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( U ) PURPOSE OF THE VISIT: 

• (TS SI NF) Mr Barbier and Mr Pailloux will present technical details of the cvber 
attacks against the French Presidential network from May 2012. Mr Barbier and Mr 
Pailloux will meet with senior leaders and analysts from NTOC, SID. LAD, and FAD in 
hopes that NSA can help with attribution. 

( U ) VISITOR REQUESTED: 

• (S REL TO USA, FRA) DGSE and ANSSI requests help in attributing the cyber attacks 
against the French Presidential network in May 2012. 

(U) CDRDCDR DDIR GUIDANCE: N/A 

(U) PREP SESSION GUIDANCE: 

• (TS SI NF) Prep sessions are scheduled forDIRNSA and D DIR on 12 April. A 
timeline of events will be prepared that describes the cyber attack, the claims by French 
media, discussions with DIRNSA, and steps NSA has taken to support the Partner 

(U) NS A/CSS REQUESTED: 

• (S REL TO USA. FRA) Technical data associated with the cyber attacks against the 
French Presidential network. To date, no advance information has been shared with NSA. 

(U) CYBERC’OM REQUESTED: N/A 

(U) COMMON THRE ADS: 

• (S REL TO USA, FRA) Stress the potential value of the NSA -DGSE -ANSSI partnership 
through timely cyber defense exchanges 

( U) KEY TOPIC AREAS: 

• (U. FOUO) Computer Netw-ork Defense (CND) 

(U) key TAKEAWAYS: 

• (S//REL TO USA, FRA) DIRECTORATE S ROLE: Recommend DIRNSA 
emphasize the following point: 
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• (S//REL TO USA, FRA) CM) Collaboration: Reiterate the need for continued 
close cooperation on CND efforts and emphasize the importance of DGSE and 
ANSSI collaboration to leverage SIGINT to support CND 



(U) VISIT FORMAT: 

• (S // REL USA. FRA) Mr. Barbier and Mr. Pailloux will lead a technical discussion 
relating to the May 2012 cyber attacks against the French Presidential network D DIR 
will host lunch and Courtesv Calls are scheduled with NSOC, NTOC and DIRNSA. 

• S REL TO USA. FRA)NSA participants include DIRFA. NTOC DIR. IA DIR. SID 
DIR, SUSLAF, FAD Desk Officers. Analysts, and technical Target experts. 

(U) PREVIOUS VISITS AND RESPECTrVE TOPICS: 

• (S ' REL USA, FRA) Mr. Barbier last visited NSA in May 2012 for the Strategic 
Planning Conference Mr Pailloux last visited NSA in February 2011; this visit focused 
on cyber issues. 

a 1 ) POTENTLAL LANDMINES: 

• (TS ‘SI NF) There is a chance that helping attribute the cyber attacks against the French 
Presidential network may reveal a U.S. ally is responsible. 

• (TS. SI. NF) The French have not been forthcoming in sharing technical details of the 
cyber attacks There is suspicion that the information is not being shared prior to the visit 
because the French want to see how NSA responds when they present their findings. 
Dining the January 2013 DIRNSA visit to Paris, both DGSE and ANSSI asked GEN 
Alexander about the cyber attacks in an attempt to ascertain whether or not the U S was 
responsible for the attacks (as reported in French magazines). At no time was FAD made 
aware that DGSE and ANSSI intended to raise the issue with DIRNSA 

(U) OTHER INFORMATION: 

• (TS. SI NF) TAO confirmed that this was not a TAO operation TAO asked most of 
NSA's close l” 2 n<i Party Partners whether they were involved (CIA, GCHQ. and CSEC 
were the mostly likely suspects): everyone has denied involvement TAO intentionally 
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did not ask either Mossad or ISNU whether they were involved as France is not an 
approved target for joint discussion 

• (S NF) After repeated requests for technical information relating to the cyber attacks (in 
advance of the visit). ANSSI and DGSE have not provided any details. 

(V) RECENT PRESS INDICATIONS: 

• (U) The cyber attacks against the French Presidential network took place in May 2012. 

An initial press report from Paris At lannco, “ French Website Savs Turkish Hackers 
Behind Elvsee Cvber Attacks ." dated 12 July 2012. stated it was believed “the attacks 
originated from France's allies “ and speculated Turkish hackers with possible links to 
Turkish 'intelligence services or government bodies might be responsible. No follow-on 
press reports have been seen that place blame on Turkey. A press report from Paris 

L ' Express , “ French Weekly Reports on Alleged US Cvber Espionage Attack on Elvsee 
Palace ," dated 20 November 2012, shifted blame for the attacks toward the United States 
On 27 November 2012. 'arret sur images contacted the Pans L ' Express author who 
shared there are an “array of assumptions^ that enable pointing to the United States as the 
origin of this attack. Paris L 'Express contacted ANSSI and the Elvsee. both declined to 
comment. 
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